panic "wlock already held" when changing ipv6 default route

Hi,

When changing the ipv6 default route I get a panic on wlock already held.
Could be related to r293424 lock changes, haven't checked an older version yet.

route add -inet6 default fe80::7
route change -inet6 default fe80::7

panic: rw_rlock: wlock already held for rib head lock _at_
/usr/src/sys/net/route.c:445
cpuid = 0
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0050ee01d0
vpanic() at vpanic+0x182/frame 0xfffffe0050ee0250
kassert_panic() at kassert_panic+0x126/frame 0xfffffe0050ee02c0
__rw_rlock() at __rw_rlock+0xe7/frame 0xfffffe0050ee0360
rtalloc1_fib() at rtalloc1_fib+0x86/frame 0xfffffe0050ee0420
ifa_ifwithroute() at ifa_ifwithroute+0x83/frame 0xfffffe0050ee0460
rt_getifa_fib() at rt_getifa_fib+0xe7/frame 0xfffffe0050ee0480
rtrequest1_fib() at rtrequest1_fib+0x59c/frame 0xfffffe0050ee0570
route_output() at route_output+0x653/frame 0xfffffe0050ee07c0
sosend_generic() at sosend_generic+0x436/frame 0xfffffe0050ee0880
soo_write() at soo_write+0x42/frame 0xfffffe0050ee08b0
dofilewrite() at dofilewrite+0x87/frame 0xfffffe0050ee0900
kern_writev() at kern_writev+0x68/frame 0xfffffe0050ee0950
sys_write() at sys_write+0x60/frame 0xfffffe0050ee09a0
amd64_syscall() at amd64_syscall+0x2db/frame 0xfffffe0050ee0ab0
Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe0050ee0ab0
--- syscall (4, FreeBSD ELF64, sys_write), rip = 0x800977b7ba, rsp =
0x7fffffffe2d8, rbp = 0x7fffffffeb90 ---
KDB: enter: panic
[ thread pid 644 tid 100054 ]
Stopped at      kdb_enter+0x3b: movq    $0,kdb_why

Booted into livecd with snapshot iso in a VirtualBox VM and ran the
commands above.
FreeBSD-11.0-CURRENT-amd64-20160308-r296485-bootonly.iso

-- Guy